PHP version: PHP 5.3.10-1ubuntu3.4 with Suhosin-Patch (cli)
Used in apache2 with: libapache2-mod-php5

The global options memory_limit for PHP is set to 512M. So far so good.
Now a script tries to allocate more than this and fails due to the memory_limit. So far so good.

But now a strange thing happens. When I create .htacess with php_value memory_limit "1025M" there are errors in the syslog just with requesting a simple PHP file with one echo.

Sep 21 18:14:02 ccollard2 suhosin[8611]: ALERT - script tried to increase memory_limit to 1082130432 bytes which is above the allowed value (attacker '*******', file '/home/www-data/*********/bla/test.php', line 14)

BUT when I try to set php_value to memory_limit "1024M" no error is shown at the output. So I tried to check some suhosin configs for this 1024M limit and found nothing.

So my initial question is:
Why does the server allow up to 1024M memory consumption even if global option is set to <1024M?

I assure that no config file overrides the global option and phpinfo() shows the globally set memory limit. The php script is not the question here. It was just a testing script.

Update: Suhosin seems to have a default value of 1024M memory allocation.
So the user can set memory_limit up to 1024M with htaccess but w/o htaccess the usual global limit. So with commented limit suhosin has an invisible limit of 1024 and the user can set this limit manually. But without manual setting the usual global limit will limit user scripts.

  • So what is at line 14 of that PHP script? Sep 21, 2012 at 16:20
  • That was just the testing script ;) And that was not the question itself. It alerts at 1024 and not at 512 (like its set in php.ini).
    – thonixx
    Sep 21, 2012 at 16:23
  • So I tried to check some suhosin configs for this 1024M limit and found nothing. --> Are you sure? Show us your sohosin config?
    – quanta
    Sep 21, 2012 at 16:28
  • Thanks for your input. I tried different things. Check the "update" in the question.
    – thonixx
    Sep 21, 2012 at 17:32

2 Answers 2


You mention .htaccess - yet your posting details from the CLI version of PHP (PHP 5.3.10-1ubuntu3.4 with Suhosin-Patch (cli)).

If the CLI version uses a different php.ini (quite-common) - then that's why you can't see the defined 1024MB

Run the following

php -i | grep -i php.ini

And compare it to the output of a file via a web browser, containing the following

<?php phpinfo();

If the path to php.ini differs, there's your answer, you're editing the wrong file.

For Suhosin

There is a specific setting for memory limit, which would be defined (typically) in /etc/php5/conf.d/20suhosin.ini

suhosin.memory_limit = 1024M
  • I am not a noob, I have done this ;) Just two ini files which I know.
    – thonixx
    Sep 21, 2012 at 17:32
  • Thanks for your answer, but I found the real answer.
    – thonixx
    Sep 21, 2012 at 17:54
  • The real answer being a re-post of what I wrote ... suhosin.memory_limit = 1024M Sep 21, 2012 at 17:54
  • Not really. You said a specific setting for suhosing would be stored in /etc/php5/conf.d/ but you never said that 1024M is the default setting even if suhosin.memory_limit is set to 0 (zero).
    – thonixx
    Sep 21, 2012 at 21:19

I found the solution now.

The globally set memory_limit acts like a soft limit.
The suhosin limit is hard limit. No script can consume more memory than suhosin allows.

With suhosin's limit to 0 a user can set a limit up to 1024M where suhosin says "no more memory consumption".
As long as an user script defines memory limit with "ini_set" it can't go over the soft limit when suhosin's memory limit is 0. But if suhosin is set to a specific M-integer no script is allowed to consume more than suhosin says.

Suhosin defines the maximum of memory limit.
Usual memory_limit defines the limit which is default and can be overwritten with .htacces/ini_set. Suhosin's suhosin.memory_limit = 0 or commented defines 1024M.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.